The Register of Known Spam Operations (ROKSO) database collates information and evidence on known persistent spam operations that have been terminated by a minimum of 3 Internet Service Providers for spam offenses.

80% of spam received by Internet users in North America and Europe can be traced via aliases, addresses, redirects, locations of servers, domains and dns setups, to a hard-core group of around 100 known spam operations, almost all of whom are listed in the ROKSO database.

Each spam operation, or "spam gang", consists on average of between 1 to 5 spammers (giving an etimated total of 300-400 spammers).

Many of these pretend to operate 'offshore' and hide behind anonymity. Some pretend to be small 'ISPs' themselves, claiming to their providers that the spam is being sent not by them but by non-existent 'customers'. When caught, almost all use the age old tactic of lying to each ISP long enough to buy a few days or weeks more of spamming and when terminated simply move on to the next ISP already set up and waiting.

Those on the ROKSO List are the persistent spammers you definitely do NOT want on your network.

ROKSO is a "3 Strikes" register. To be placed on the ROKSO list a spammer must first be terminated by a minimum of 3 ISPs for AUP violations. Once listed in ROKSO, IP addresses under the control of ROKSO-listed spammers are automatically and preemptively listed in the Spamhaus Block List (SBL).

For qualified Law Enforcement Agencies Spamhaus provides a special version of this ROKSO database which gives access to records with evidence, logs and information on illegal activities of many of these operations, too sensitive to publish in the public ROKSO.